grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. root@kitploit: ➜ ./grafanaExp -h NAME:...

ATTACKdatamap

ATTACKdatamap Una evaluación de fuentes de datos a nivel de evento para mostrar la cobertura potencial del marco "MITRE ATT&CK". Esta herramienta ha sido desarrollada por mí y no tiene afiliación con "MITRE" ni con su excelente equipo "ATT&CK"; se ha creado con la intención de facilitar el mapeo ...

CVE-2025-70829

CVE-2025-70829: Information Exposure in Datart 中文文档 1. Vulnerability Overview CVE ID : CVE-2025-70829 Product : Datart Version : v1.0.0-rc.3 Vulnerability Type : Information Exposure An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive dat...

CVE-2026-25212

CVE-2026-25212 – PoC de RCE en Percona PMM Crítico – CVSS 9,9 – Ejecución remota de código autenticada en PMM 3.7. Descripción Esta prueba de concepto explota una vulnerabilidad donde un usuario interno de PostgreSQL en PMM mantiene privilegios 'SUPERUSER'. Un atacante autenticado con derechos...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Implementación en Python de una herramienta para descifrar y cifrar datos sensibles en Grafana, abordando específicamente las vulnerabilidades asociadas con CVE-2021-43798. Grafana cifra todas las contraseñas de las fuentes de datos utilizando el algoritmo AES con la...

solr_exploit

Declaración Los métodos de detección de vulnerabilidades, archivos y demás contenidos proporcionados aquí están destinados exclusivamente para que los profesionales de seguridad los utilicen con autorización legal, con el objetivo de verificar la seguridad de los servidores autorizados. Los...

grafanaExp

grafanaExp Explota la vulnerabilidad de lectura arbitraria de archivos CVE-2021-43798 en Grafana. Detecta automáticamente si hay vulnerabilidad, los plugins presentes, extrae claves, descifra el archivo de base de datos del servidor y muestra la información de datasource. Uso Proporciona las...

grafana-ssrf

grafana-ssrf Authenticated SSRF in Grafana. Notes Azure metadata header has been added to all SSRFS Google metadata header has been added to all SSRFS SSRF will not follow redirects no matter what so ensure url is direct. If login is via SSO or other none grafana logins please grab your session...

CVE-2026-86784

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

EUVD-2026-80205

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86784

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-86784 Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-18421

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421 Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

EUVD-2026-79187

Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller update, updatedatasource, and deletedatasource, which resolve a ConfiguredDataSource directly from an attacker-supplied identifier without confirming the requester'...

CVE-2026-18421

Concrete CMS versions 9 through 9.5.2 contain a missing authorization check in the Boards data source dashboard controller . The three affected actions (update , update_data_source , and delete_data_source ) resolve a ConfiguredDataSource directly from an attacker-supplied identifier without conf...

cacti-rce-cve-2022-46169-vulnerable-application

Aplicación vulnerable de inyección de comandos en Cacti v1.2.22 CVE-2022-46169 Esta es una aplicación vulnerable para probar el exploit de la vulnerabilidad Cacti CVE-2022-46169. ¡ADVERTENCIA! Esta aplicación contiene vulnerabilidades de seguridad graves. ¡Úsela bajo su propio riesgo! Se recomien...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource...

Astra Linux – Vulnerability in Jackson-Databind

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource...

Astra Linux – Vulnerability in libdbi-perl

A issue was discovered in the DBI module through version 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically specified via the fdir attribute in the data source name DSN. NOTE: This issue exists due to an incomplete fix for CVE-2014-10401...